package com.edu.applet.security.cfg;

import com.edu.framework.config.SecurityConfig;
import com.edu.framework.config.properties.PermitAllUrlProperties;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.filter.CorsFilter;

/**
 * 小程序 spring security配置
 */
@Configuration
public class AppletSecurityConfig {

    public static final int APPLET_SECURITY_FILTER_ORDER = SecurityConfig.DEFAULT_SECURITY_FILTER_ORDER  - 1;

//    /**
//     * 退出处理类
//     */
//    @Autowired
//    private LogoutSuccessHandlerImpl logoutSuccessHandler;
//
//    /**
//     * token认证过滤器
//     */
//    @Autowired
//    private JwtAuthenticationTokenFilter authenticationTokenFilter;

    /**
     * 跨域过滤器
     */
    @Autowired
    private CorsFilter corsFilter;

    /**
     * 允许匿名访问的地址
     */
    @Autowired
    private PermitAllUrlProperties permitAllUrl;

    @Order(AppletSecurityConfig.APPLET_SECURITY_FILTER_ORDER)
    @Bean
    protected SecurityFilterChain filterChain2(HttpSecurity httpSecurity) throws Exception {
        return httpSecurity.antMatcher("/api/**")
                .authorizeHttpRequests(req ->
                    req.antMatchers("api/**").permitAll()
                )
                .build()
        ;
    }
}
